Netgate vulnerabilities
We track 22 vulnerabilities in Netgate products across 5 products. 22 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest Netgate vulnerabilities
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block
- 8.8 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common
- 7.5 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}
- 7.2 High severity
pfSense CE: Improper Neutralization of CRLF Sequences
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prep
- 7.2 High severity
pfSense CE: Improper Neutralization of CRLF Sequences
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interf
- 7.2 High severity
pfSense CE: Improper Neutralization of CRLF Sequences
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metach
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a g
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments pri
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit t
- 8.8 High severity
pfSense-pkg-frr: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks
- 8.5 High severity
pfSense Plus: Path Traversal: '../filedir'
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker
- 8.8 High severity
pfSense: Improper Limitation of a Pathname to a Restricted Directory
Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability. The spe
- 8.8 High severity
Pfsense Ce: Improper Control of Generation of Code
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can expl
- 8.8 High severity
Pfsense: Improper Neutralization of Special Elements used in a Command
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.
- 9.8 Critical severity
Pfsense Plus: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.
- 8.8 High severity
Pfsense: XML Injection
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.
- 9.8 Critical severity
pfblockerng: Improper Neutralization of Special Elements used in an OS Command
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.
- 8.8 High severity
pfSense CE and pfSense Plus: Improper Limitation of a Pathname to a Restricted Directory
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing file
- 8.8 High severity
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software…
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to ex